AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

An organization stores sensitive logs in the prod-private-logs S3 bucket in its production AWS account. To run periodic queries, an analytics account currently accesses the bucket through a bucket policy that grants s3:GetObject to an IAM role in that account. Security policy now mandates that every cross-account access path uses an external ID. What is the most secure way to comply without breaking the analytics workflow?

Add a Condition element with sts:ExternalId to the existing S3 bucket policy so that the analytics role must present the correct external ID when calling GetObject.
Attach a service control policy (SCP) to the analytics account that denies s3:GetObject unless the request includes the required external ID header.
Create an IAM role in the production account that trusts the analytics account, includes a Condition requiring a specific sts:ExternalId value, attaches a policy allowing s3:GetObject on the bucket, and remove the direct bucket policy statement. Have the analytics workflow assume this role before accessing S3.
Enable S3 Object Lock in compliance mode for the bucket and require callers to specify the external ID through object version IDs when fetching objects.

Report Issue

Answer Description

An external ID can only be evaluated by AWS STS when an external principal tries to assume a role. S3 bucket policies do not recognize the sts:ExternalId condition key, so the requirement cannot be enforced there. The secure pattern is to replace direct bucket access with a production-side IAM role whose trust policy allows the analytics account to call sts:AssumeRole only when the expected external ID is supplied. The role then carries a permissions policy that grants the minimum s3:GetObject access to the bucket. The analytics workflow assumes the role and uses the temporary credentials to read the objects, satisfying both the security mandate and the functional need. Adding sts:ExternalId to the bucket policy, creating an SCP, or enabling Object Lock would not enforce the requirement or would block legitimate access.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.